Add policy-driven annotations to vulnerability analyses

### Current Behavior

Vulnerability Policies don't have support for tagging the analysis if violated.

### Proposed Behavior

Allow vulnerability policies to attach `tags` to findings when a policy matches. Tags will be strictly policy-driven, user edits should not set or override them.
Policies can specify a list of tags, reconciliation applies them to matching analyses and removes them when policies stop applying.

**Design Notes:**

1. Store tags inline on the `ANALYSIS` record, and clear them when a finding is no longer covered by a policy. (For backward-compatible migration, add a nullable `POLICY_TAGS` column to the `ANALYSIS` table (JSON/array) and map it on the Analysis domain object.)
2. Extend [`VulnerabilityPolicyAnalysis`](https://github.com/DependencyTrack/hyades-apiserver/blob/main/apiserver/src/main/java/org/dependencytrack/policy/vulnerability/VulnerabilityPolicyAnalysis.java) with tags.
3. Reconciliation:
- In [`AnalysisReconciler`](https://github.com/DependencyTrack/hyades-apiserver/blob/main/apiserver/src/main/java/org/dependencytrack/vulnanalysis/AnalysisReconciler.java) derive desired `tags` from policy analysis.
- If tags differ from stored policyTags, update analysis and add an audit comment.
- When a finding loses policy coverage, clear policyTags.
4. UI exposure: Include policyTags in analysis/findings responses.
5. Audit notification: Optional : Add a tag-change entry to the analysis audit comments.

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/hyades/blob/main/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/hyades/issues) for whether this enhancement was already requested